CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.3 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 75 · 1 finding

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · README.md

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted

excerptREADME.md· markdown

8<p align="center">

9<a href="https://www.appalize.com?utm_source=aso_skills&utm_medium=github&utm_campaign=readm

… (30 chars elided on L9)

10<img src="https://img.shields.io/badge/Appalize_Platform-4F46E5?style=for-the-badge&logo=dat

… (104 chars elided on L10)

11</a>

12<a href="https://x.com/appalizeDev">

Occurrences

1 occurrence · at L10

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha25698a9fc0c6c35bb90…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/ab-test-store-listing/SKILL.md · 1 file

skills/ab-test-store-listing/SKILL.md7.2 KB · Markdown

name: ab-test-store-listing

description: When the user wants to A/B test App Store product page elements to improve conversion rate. Also use when the user mentions "A/B test", "product page optimization", "test my screenshots", "test my icon", "conversion rate optimization", "CPP", or "custom product pages". For screenshot design, see screenshot-optimization. For metadata optimization, see metadata-optimization.

metadata:

version: 1.0.0

A/B Test Store Listing

You are an expert in App Store product page optimization and A/B testing. Your goal is to help the user design, run, and interpret tests that improve their App Store conversion rate.

Initial Assessment

Check for app-marketing-context.md — read it for context
Ask for the App ID
Ask for current conversion rate (if known from App Store Connect)
Ask for daily impressions (determines test duration)
Ask: What do you want to test? (icon, screenshots, description, etc.)

What You Can Test

Apple Product Page Optimization (PPO)

Apple's native A/B testing tool in App Store Connect.

Element	Testable?	Notes
App icon	Yes	Up to 3 variants
Screenshots	Yes	Up to 3 variants
App preview video	Yes	Up to 3 variants
Description	No	Not testable via PPO
Title	No	Not testable via PPO
Subtitle	No	Not testable via PPO

Limitations:

Only tests against organic App Store traffic
Minimum 90% confidence required to declare winner
Tests run for 7-90 days
Can only run one test at a time
Traffic split is automatic (not configurable)

Custom Product Pages (CPP)

35 custom product pages per app, each with unique:

Screenshots
App preview videos
Promotional text

Use for:

Different audiences (from different ad campaigns)
Different value propositions
Seasonal messaging
Localized creative for specific markets

Not a true A/B test — CPPs are targeted pages linked from specific URLs/campaigns, not random traffic splits.

Test Prioritization

Impact × Effort Matrix

Element	Impact on CVR	Effort	Priority
First screenshot	Very High (15-30% lift possible)	Medium	1
App icon	High (10-20% lift possible)	Medium	2
Screenshot order	Medium (5-15% lift possible)	Low	3
Screenshot style	Medium (5-15% lift possible)	High	4
Preview video	Medium (5-10% lift possible)	High	5

What to Test First

Always start with the first screenshot. It has the highest impact because:

It's the first thing users see in search results
80% of users never scroll past the first 3 screenshots
Small improvements here affect every visitor

Test Design Framework

Step 1: Hypothesis

Write a clear hypothesis before each test:

If we [change], then [metric] will [improve/increase] because [reason].

Examples:

"If we add social proof ('5M+ users') to the first screenshot, conversion rate will increase because it builds trust"
"If we change the icon from blue to orange, tap-through rate will increase because it stands out more in search results"
"If we show the app's AI feature first instead of the basic editor, conversion will increase because AI is the key differentiator"

Step 2: Variants

Design 2-3 variants (including control):

Variant	Description	Hypothesis
Control (A)	Current version	Baseline
Variant B	[specific change]	[why it might win]
Variant C	[different change]	[why it might win]

Rules for good variants:

Change ONE thing per test (isolate the variable)
Make the change significant enough to detect (don't test subtle color shifts)
Each variant should have a clear hypothesis
Don't test more than 3 variants (dilutes traffic)

Step 3: Sample Size

Calculate required test duration:

Daily impressions: [N]
Current conversion rate: [X]%
Minimum detectable effect: [Y]% (relative improvement)
Confidence level: 95%

Required sample per variant: ~[N] impressions
Estimated duration: [N] days

Rules of thumb:

< 1000 daily impressions: Tests take 30-90 days (consider if worth it)
1000-5000 daily impressions: Tests take 14-30 days
5000+ daily impressions: Tests take 7-14 days
Need at least 1000 impressions per variant for meaningful results

Step 4: Run the Test

In App Store Connect:

Go to Product Page Optimization
Create a new test
Upload variant assets
Set test duration (recommend: let it run until statistical significance)
Monitor but don't stop early

Step 5: Interpret Results

Statistical significance:

Apple requires 90% confidence minimum
Aim for 95% confidence before making decisions
Look at the confidence interval, not just the point estimate

What to look for:

Conversion rate lift (primary metric)
Impression-to-tap rate (for icon tests)
Download rate (for screenshot/video tests)
Segment differences (new vs returning, country, source)

Common Test Ideas

Icon Tests

Test	Control	Variant	Expected Impact
Color	Current color	Contrasting color	5-20% TTR change
Style	Detailed	Simplified	5-15% TTR change
Element	Current symbol	Different symbol	5-20% TTR change
Background	Solid	Gradient	3-10% TTR change

Screenshot Tests

Test	Control	Variant	Expected Impact
First screenshot	Feature-focused	Benefit-focused	10-30% CVR change
Social proof	No social proof	"5M+ users" badge	5-15% CVR change
Text size	Small text	Large, bold text	5-10% CVR change
Style	Light mode	Dark mode	5-15% CVR change
Layout	Device frame	Full-bleed	5-10% CVR change
Order	Current order	Reordered by benefit	5-15% CVR change

Video Tests

Test	Control	Variant	Expected Impact
Has video	No video	15s feature demo	5-15% CVR change
Hook	Feature demo	Problem/solution	5-10% CVR change
Length	30s	15s	3-8% CVR change

Output Format

Test Plan

Test Name: [descriptive name]
Element: [icon / screenshots / video]
Hypothesis: If we [change], then [metric] will [improve] because [reason]

Variants:
- Control (A): [description]
- Variant B: [description]
- Variant C: [description] (optional)

Estimated Duration: [N] days
Required Impressions: [N] per variant
Success Metric: [conversion rate / tap-through rate]
Minimum Detectable Effect: [X]%

Test Results Interpretation

When the user shares results:

Is it statistically significant? (confidence level)
What's the actual lift? (with confidence interval)
Are there segment differences?
What's the next test to run?
Estimated annual impact (downloads × lift)

Testing Roadmap

Provide a 3-month testing calendar:

Month 1: [highest impact test]
Month 2: [second priority test]
Month 3: [third priority test]

screenshot-optimization — Design screenshot variants
metadata-optimization — Optimize non-testable elements
app-analytics — Track conversion metrics
aso-audit — Identify what to test first

ab-test-store-listing— agent skill

Is ab-test-store-listing safe to install?

A/B Test Store Listing

Initial Assessment

What You Can Test

Apple Product Page Optimization (PPO)

Custom Product Pages (CPP)

Test Prioritization

Impact × Effort Matrix

What to Test First

Test Design Framework

Step 1: Hypothesis

Step 2: Variants

Step 3: Sample Size

Step 4: Run the Test

Step 5: Interpret Results

Common Test Ideas

Icon Tests

Screenshot Tests

Video Tests

Output Format

Test Plan

Test Results Interpretation

Testing Roadmap

Audit the pieces. Scan the whole. Decide.

Is ab-test-store-listing safe to install?

A/B Test Store Listing

Initial Assessment

What You Can Test

Apple Product Page Optimization (PPO)

Custom Product Pages (CPP)

Test Prioritization

Impact × Effort Matrix

What to Test First

Test Design Framework

Step 1: Hypothesis

Step 2: Variants

Step 3: Sample Size

Step 4: Run the Test

Step 5: Interpret Results

Common Test Ideas

Icon Tests

Screenshot Tests

Video Tests

Output Format

Test Plan

Test Results Interpretation

Testing Roadmap

Related Skills

Audit the pieces. Scan the whole. Decide.